A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the homedir path. This flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then has its ownership transferred to the new home directory's unprivileged user.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0053 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2020-10737:
    A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5     and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly     created home and changes its ownership to the home's user without properly checking the homedir path. This     flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then     has its ownership transferred to the new home directory's unprivileged user.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0053 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-10737:
    A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5     and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly     created home and changes its ownership to the home's user without properly checking the homedir path. This     flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then     has its ownership transferred to the new home directory's unprivileged user.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5     and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly     created home and changes its ownership to the home's user without properly checking the homedir path. This     flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then     has its ownership transferred to the new home directory's unprivileged user. (CVE-2020-10737)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the oddjob-0.34.7-6.el9 build changelog.

  - A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5     and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly     created home and changes its ownership to the home's user without properly checking the homedir path. This     flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then     has its ownership transferred to the new home directory's unprivileged user. (CVE-2020-10737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5169-1 advisory.

    Matthias Gerstner discovered that there was a race condition in the mkhomedir tool shipped with the oddjob     package. An authenticated attacker could use this to setup a symlink attack and change permissions on     files on the host filesystem.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has oddjob packages installed that are affected by a vulnerability:

  - A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5     and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly     created home and changes its ownership to the home's user without properly checking the homedir path. This     flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then     has its ownership transferred to the new home directory's unprivileged user. (CVE-2020-10737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the oddjob packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A race condition was found in the mkhomedir tool     shipped with the oddjob package in versions before     0.34.5 and 0.34.6 wherein, during the home creation,     mkhomedir copies the /etc/skel directory into the newly     created home and changes its ownership to the home's     user without properly checking the homedir path. This     flaw allows an attacker to leverage this issue by     creating a symlink point to a target folder, which then     has its ownership transferred to the new home     directory's unprivileged user.(CVE-2020-10737)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4687 advisory.

  - oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack     (CVE-2020-10737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4687 advisory.

    [0.34.5-3]
    - Support HOME_MODE from /etc/login.defs       Resolves: rhbz#1886362

    [0.34.5-2]
    - Add gating tests using idm:DL1 module stream and upstream tests       Resolves: rhbz#1682457

    [0.34.5-1]
    - Upstream release 0.34.5
    - Resolves: rhbz#1833289 - Rebase oddjob to 0.34.5
    - Resolves: rhbz#1833052 - CVE-2020-10737       oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4687 advisory.

    The oddjob packages contain a D-Bus service which performs particular tasks for clients which connect to     it and issue requests using the system-wide message bus.

    The following packages have been upgraded to a later upstream version: oddjob (0.34.5). (BZ#1833289)

    Security Fix(es):

    * oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack     (CVE-2020-10737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update includes a security fix for CVE-2020-10737. Additionally,

From 0.34.6 :

  - update license on src/buffer.h

  - changes '/var/run' to '/run' in systemd service file     (Orion Poplawski, #1834511)

From 0.34.5 :

  - apply patch from Matthias Gerstner of the SUSE security     team to fix a possible race condition in the mkhomedir     helper (noted above, this fixes CVE-2020-10737)

  - only process SELinux contexts if SELinux is not disabled     (Alexander Bokovoy, #1828855)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
276414	TencentOS Server 3: oddjob (TSSA-2022:0053)	Nessus	Tencent Local Security Checks	medium
236511	Alibaba Cloud Linux 3 : 0053: oddjob (ALINUX3-SA-2022:0053)	Nessus	Alibaba Cloud Linux Local Security Checks	medium
222986	Linux Distros Unpatched Vulnerability : CVE-2020-10737	Nessus	Misc.	medium
191180	CentOS 9 : oddjob-0.34.7-6.el9	Nessus	CentOS Local Security Checks	medium
183152	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : oddjob vulnerability (USN-5169-1)	Nessus	Ubuntu Local Security Checks	medium
147336	NewStart CGSL MAIN 6.02 : oddjob Vulnerability (NS-SA-2021-0063)	Nessus	NewStart CGSL Local Security Checks	medium
146690	EulerOS 2.0 SP2 : oddjob (EulerOS-SA-2021-1334)	Nessus	Huawei Local Security Checks	medium
145910	CentOS 8 : oddjob (CESA-2020:4687)	Nessus	CentOS Local Security Checks	medium
144180	EulerOS 2.0 SP8 : oddjob (EulerOS-SA-2020-2524)	Nessus	Huawei Local Security Checks	medium
142771	Oracle Linux 8 : oddjob (ELSA-2020-4687)	Nessus	Oracle Linux Local Security Checks	medium
142405	RHEL 8 : oddjob (RHSA-2020:4687)	Nessus	Red Hat Local Security Checks	medium
142132	EulerOS 2.0 SP5 : oddjob (EulerOS-SA-2020-2260)	Nessus	Huawei Local Security Checks	medium
140853	EulerOS 2.0 SP3 : oddjob (EulerOS-SA-2020-2086)	Nessus	Huawei Local Security Checks	medium
136756	Fedora 31 : oddjob (2020-b1fa09aa64)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2020-10737

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium